CVE-2024-50001

What it actually does

Erroneous DMA unmap operation in the mlx5 multi-packet WQE transmit error path removes a random active mapping from the SQ FIFO when a DMA mapping attempt fails under memory pressure, potentially causing the IOMMU to treat subsequent IOVA access as rogue and place the PCI function into an error state.

Why it matters to the business

Systems using mlx5 NICs may experience sudden loss of network connectivity or complete host instability during memory-constrained conditions such as heavy workloads or stress testing, increasing downtime risk on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers memory pressure to force DMA mapping failure in the mlx5 transmit path; the flawed error handler then unmaps an unrelated live mapping, allowing the hardware to present an invalid IOVA that the IOMMU detects as unauthorized access and responds by erroring the PCI function.

How to fix it

Upgrade the Linux kernel to a version containing commit ca36d6c1a49b6965c86dd528a73f38bc62d9c625 or later; for packaged distributions apply the corresponding fixed version such as python-pillow 5.1.1-16.el8 where backports exist.

How to confirm the fix worked

Confirm the running kernel contains commit ca36d6c1a49b6965c86dd528a73f38bc62d9c625 via git log or package version checks; reproduce memory-pressure DMA failure scenarios in a test environment and verify no erroneous unmap or IOMMU error occurs.

Typical attack path

1. Obtain local code execution on the target host
2. Induce memory pressure to exhaust IOMMU page table allocations
3. Send network traffic that exercises the multi-packet WQE transmit code path
4. Trigger DMA mapping failure and subsequent erroneous unmap
5. Observe IOMMU-reported rogue DMA access and resulting PCI function error state

How to detect it

Review dmesg and kernel logs for IOMMU rogue DMA messages or PCI function error state entries around periods of high memory pressure on mlx5 devices; correlate with transmit path activity in the mlx5 driver.

What your security team should do

• Prioritize kernel updates on all systems exposing mlx5 hardware within the next maintenance window
• Monitor memory utilization and IOMMU error logs on production mlx5 hosts until patches are deployed
• Apply the fix to development and staging environments first to validate stability under load